PHP Script that inserts URL variables into a mysql db?

Question

I'm looking for a simple and secure script to insert rows into a mysql table from a php script.

by calling http://www.myserver.com/addtosometable.php?1=asdf&2=asdf....

I'm not asking how specifically, rather I thought this might be a good platform to build a example script and keep it up to date with best practices...

Cheers

I thought we might develop an example script that includes the variable cleaning etc... — Dan
– Dan, Commented May 6, 2009 at 2:13

Dana the Sane · Accepted Answer · 2009-05-06 01:29:59Z

2

all the URL variables (GET variables) are put into the PHP variable $_GET as an array.

Using your example above myfile.php?1=asdf&2=asdf your script would have access to an array that looks like this:

array(
    1 => "asdf"
    2 => "asdf"
)

If you want to see this for yourself, just put this in your file:

print_r($_GET);

From there it should be a simple task of cleaning the variables to avoid injection attacks and then creating an INSERT statement. I'd need to know more about your table structure and whatnot to help you specifically with that. See the docs on mysql_real_escape_string.

edited May 6, 2009 at 1:29

Dana the Sane

15.2k8 gold badges61 silver badges81 bronze badges

answered May 6, 2009 at 1:10

nickf

548k199 gold badges660 silver badges727 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Macaubas Over a year ago

It might also help to take a look at the urlencode/decode functions, if the content you want to pass contains special chars, like >,<, space, etc.. See: br2.php.net/manual/en/function.urlencode.php

nickf Over a year ago

i believe that the variables will already be decoded when they're in $_GET

hapes · Accepted Answer · 2009-05-06 04:24:33Z

0

If you're using MySQL 5, you can use prepared statements to avoid most forms of SQL Injection.

$stmt = $db->prepare("INSERT INTO table ( col1, col2 ) values ( ?, ? );
// check for errors 
$result = $stmt->execute( $_GET['1'], $_GET['2'] );
// check for errors

I believe you still have to worry about XSS (Cross-Site-Scripting) attacks, but that's beyond my ken.

answered May 6, 2009 at 4:24

hapes

1051 silver badge8 bronze badges

2 Comments

hapes Over a year ago

The example provided is using MDB2, which is indeed a DB framework. You can use mysqli->prepare() just as well, but it involves more statements (prepare, bind_param, execute, bind_result, fetch), compared to 3 with MDB2 (prepare, execute, fetch)

hapes Over a year ago

MDB2 is pretty painless to implement, and you can install PEAR modules without being root or even having shell access, so there's no excuse to not use a DB framework.

Collectives™ on Stack Overflow

PHP Script that inserts URL variables into a mysql db?

2 Answers 2

2 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related